<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to remove some event from log while indexing.. in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-some-event-from-log-while-indexing/m-p/173688#M34953</link>
    <description>&lt;P&gt;Hi gajananh999,&lt;/P&gt;

&lt;P&gt;find all needed information and examples in the docs about &lt;A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest"&gt;Discard specific events and keep the rest&lt;/A&gt;.&lt;/P&gt;

&lt;P&gt;cheers, MuS&lt;/P&gt;</description>
    <pubDate>Wed, 21 May 2014 11:28:14 GMT</pubDate>
    <dc:creator>MuS</dc:creator>
    <dc:date>2014-05-21T11:28:14Z</dc:date>
    <item>
      <title>How to remove some event from log while indexing..</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-some-event-from-log-while-indexing/m-p/173687#M34952</link>
      <description>&lt;P&gt;Hello Everyone,&lt;/P&gt;

&lt;P&gt;I want to remove some lines from log file while indexing the data. my log file is like&lt;/P&gt;

&lt;P&gt;date time s-computername Client-IP cs-uri-stem cs-uri-query s-contentpath sc-status cs(Referer) sc-win32-status sc-bytes cs-bytes W3WP-PrivateBytes cs-username cs(User-Agent) time-local TimeTakenMS sc-substatus s-sitename s-ip s-port RequestsPerSecond s-proxy cs-version c-protocol cs-method cs(Host) EndRequest-UTC local date CPU-Utilization cs(Cookie) BeginRequest-UTC date BeginRequest-UTC local&lt;/P&gt;

&lt;P&gt;10/5/2012 00:01.2 AEPLWEB2 66.249.73.41 /research/comparecars/compareAllFeatures.aspx car1=1587&amp;amp;car2=343&amp;amp;car3=&amp;amp;car4= E:\sites\carwale\research\comparecars\compareAllFeatures.aspx 200 - 0 8575 332 - - Mozilla/5.0 (compatible; Googlebot/2.1; +&lt;A href="http://www.google.com/bot.html"&gt;http://www.google.com/bot.html&lt;/A&gt;) 30:01.2 9469 0 &lt;A href="https://community.splunk.com/WWW.CARWALE.COM" target="test_blank"&gt;WWW.CARWALE.COM&lt;/A&gt; 192.168.1.15 80 0.9863 - HTTP/1.1 http GET &lt;A href="http://www.carwale.com"&gt;www.carwale.com&lt;/A&gt; 10/5/2012 00:01.2 10/5/2012 59.09 - 10/5/2012 59:51.7&lt;/P&gt;

&lt;P&gt;error..... 121&lt;/P&gt;

&lt;P&gt;error......186&lt;/P&gt;

&lt;P&gt;So Here i want to remove the lline which is starting with error and starting date which is first line .&lt;/P&gt;

&lt;P&gt;Please can anybody help me on this?&lt;/P&gt;

&lt;P&gt;Thanks &lt;/P&gt;

&lt;P&gt;Gajanan Hiroji&lt;/P&gt;</description>
      <pubDate>Wed, 21 May 2014 11:25:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-some-event-from-log-while-indexing/m-p/173687#M34952</guid>
      <dc:creator>gajananh999</dc:creator>
      <dc:date>2014-05-21T11:25:58Z</dc:date>
    </item>
    <item>
      <title>Re: How to remove some event from log while indexing..</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-some-event-from-log-while-indexing/m-p/173688#M34953</link>
      <description>&lt;P&gt;Hi gajananh999,&lt;/P&gt;

&lt;P&gt;find all needed information and examples in the docs about &lt;A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest"&gt;Discard specific events and keep the rest&lt;/A&gt;.&lt;/P&gt;

&lt;P&gt;cheers, MuS&lt;/P&gt;</description>
      <pubDate>Wed, 21 May 2014 11:28:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-some-event-from-log-while-indexing/m-p/173688#M34953</guid>
      <dc:creator>MuS</dc:creator>
      <dc:date>2014-05-21T11:28:14Z</dc:date>
    </item>
  </channel>
</rss>

